Biden again urges Putin to disrupt ransomware gangs operating inside Russia

The Kremlin says it has not received any official requests from U.S. law enforcement.

President Joe Biden pushed Russian President Vladimir Putin to disrupt ransomware groups operating within Russian borders in a phone call Friday, according to a White House statement.

“I made it very clear to him that the United States expects [that] when a ransomware operation is coming from his soil even though it’s not sponsored by the state, we expect [Russia] to act if we give them enough information to act on who that is,” Biden told reporters after the call.

The call came on the heels of the latest major cyberattack against a U.S. company. REvil, a ransomware group believed to be in Russia, hit Florida-based IT software company Kaseya last week. Researchers have suggested that the hack affected between 1,500 to 2000 companies.

The Kremlin says it has not received any official requests from U.S. law enforcement to take action regarding recent cyberattack. A senior White House official responded by saying it has relayed multiple, specific requests for action.

Biden’s call with Putin was meant to assess which actions the Russian government is willing to take against hackers in order for the U.S. to craft a response, the official told reporters. The official declined to comment on any steps the administration has directed or plans to direct U.S. intelligence agencies to take.

The White House has emphasized to Russia in recent days that Biden reserves the right to “take any necessary action to defend its people and its critical infrastructure in the face of this continuing challenge,” the official said.

REvil claimed responsibility for the attack in a post on its blog on July 2. U.S. officials have not officially attributed the attack to the group, however.

Attackers initially demanded $70 million in ransom, though it remains unclear if any victims have agreed to such a request. Known victims of the attack on Kaseya include multiple local governments, Swedish grocery chain COOP, international textile company Miroglio Group and several New Zealand schools.

The ransomware group was already in the crosshairs of U.S. intelligence agencies following another breach targeting the international meat supplier JBS in May. Some experts speculated that the Kaseya attack, which hit days prior to the July 4th holiday, could be interpreted as a response to increased scrutiny from the U.S. government.

The group accounts for 42% of known ransomware victims, according to the threat intelligence firm Recorded Future. The group offers its ransomware code as a service to affiliate groups, further expanding its reach in the cybercriminal world.

Ransomware has become an urgent national security issue for the Biden administration.

Before the attacks on Kaseya and JBS, the ransomware group Darkside forced fuel provider Colonial Pipeline to go offline for several days in May. The outage sparked panic-buying at gas stations throughout southern U.S. states and renewed concerns over protections for critical infrastructure, including the fuel supply.

The White House on Wednesday convened an interagency task force meeting to address the government’s response to the threat of ransomware.

The senior official emphasized that the administration’s response to ransomware will be a long-haul effort consisting of strengthening domestic cybersecurity defenses, working with international partners and assessing concerns about the use of cryptocurrency by cybercriminals.

“This is a broad campaign that won’t immediately have an on/off effect like a light switch,” the official said.

One House Democrat is pressing Commerce on the government’s spyware use

Rep. Summer Lee’s letter, first reported by CyberScoop, follows ICE confirmation of using spyware and news of a Trump ally becoming NSO Group’s executive chairman.

We’ve seen ransomware cost American lives. Here’s what it will actually take to stop it.

While White House demands deterrence, Trump shrugs

Government

• FBI officials say AI is bolstering adversaries, emphasizing need to focus on cyber basics, patching

• Feds accuse China of ‘systematic’ distillation of U.S. AI models

• CIA’s Michael Ellis says cyber intelligence is changing how the agency operates

• The G7 tells industry to hurry up and prep for post-quantum encryption

Technology

• European parliament members call for slowdown of Serbia’s EU entry over spyware use

• FCC proposes public scorecard to rate telecoms on anti-robocall efforts

• Pegasus, NoviSpy variant spyware found on devices of Serbian activists

• Wyden seeks upgraded NSA security guidance on commercial VPN use

Threats

• Chinese espionage groups swarm to exploit triple-link chain of zero-days

• Microsoft discloses two actively exploited zero-days among 974 vulnerabilities

• Attackers exploit zero-days in consistently besieged SonicWall product

• Jail time for Maine child in 764 marks turning point in federal law enforcement

Policy

• Whistleblower says USPS deploying new, ‘untested’ IT systems governing mail-in ballots

• ‘Watershed 250’ test program in Texas looks to private sector for water cybersecurity help

• Former sexual abuse victims say Grok used their images, videos to train deepfake capabilities

• Cyber threats nudge Trump to sign executive order on foreign equipment in U.S. energy infrastructure